-
Notifications
You must be signed in to change notification settings - Fork 154
/
resolve-function-by-brute-ratel-badger-hash.yml
42 lines (42 loc) · 1.25 KB
/
resolve-function-by-brute-ratel-badger-hash.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
rule:
meta:
name: resolve function by Brute Ratel Badger hash
namespace: linking/runtime-linking
authors:
- jakub.jozwiak@mandiant.com
description: Custom API hashing algorithm used in Brute Ratel Badger (version 1.3 or higher)
scopes:
static: function
dynamic: unsupported
att&ck:
- Defense Evasion::Obfuscated Files or Information::Dynamic API Resolution [T1027.007]
mbc:
- Defense Evasion::Obfuscated Files or Information [E1027]
references:
- https://bruteratel.com/release_notes/releases.txt
examples:
- 64ce9ab801d9bef5284b408c3373dd30ba2dc6952c0950c8049be067b5f24530:0x6DB42430
features:
- or:
- basic block:
- and:
- mnemonic: add
- or:
- instruction:
- mnemonic: imul
- operand[2].number: 0x801
- and:
- mnemonic: mul
- number: 0x801
- instruction:
- mnemonic: or
- operand[1].number: 0x2800000
- basic block:
- and:
- mnemonic: add
- instruction:
- mnemonic: shl
- operand[1].number: 0xB
- instruction:
- mnemonic: or
- operand[1].number: 0x2800000